Re: [PATCH 5.10.y] net: add missing ns_capable check for peer netns

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Critical] The use of `ns_capable()` instead of `netlink_ns_capable()` introduces a Confused Deputy vulnerability, leading to an incomplete CVE fix.
--

commit d08a46769cbdf6769103f5b2c4165c49f427aec5
Author: Maximilian Heyne <mheyne@amazon.de>

net: add missing ns_capable check for peer netns

This commit attempts to fix CVE-2026-31692 on older stable kernels by adding
an ns_capable check directly to interface types like veth and vxcan. It is
intended to approximate the upstream netlink_ns_capable check.

> diff --git a/drivers/net/can/vxcan.c b/drivers/net/can/vxcan.c
> --- a/drivers/net/can/vxcan.c
> +++ b/drivers/net/can/vxcan.c
> @@ -198,6 +198,11 @@ static int vxcan_newlink(struct net *net, struct net_device *dev,
>  	if (IS_ERR(peer_net))
>  		return PTR_ERR(peer_net);
>  
> +	if (!ns_capable(peer_net->user_ns, CAP_NET_ADMIN)) {
        ^^^^^^^^^^

[Severity: Critical]
Does using ns_capable() instead of netlink_ns_capable() leave open a
confused deputy vulnerability?

Since ns_capable() only evaluates the credentials of the current executing
task, an unprivileged user might be able to open a netlink socket, prepare a
malicious RTM_NEWLINK payload, and pass the socket file descriptor to a
privileged process.

If the privileged process writes to the socket, ns_capable() will check the
privileged current task instead of the netlink socket creator's credentials
and incorrectly allow the operation.

> +		put_net(peer_net);
> +		return -EPERM;
> +	}
> +
>  	peer = rtnl_create_link(peer_net, ifname, name_assign_type,
>  				&vxcan_link_ops, tbp, extack);
>  	if (IS_ERR(peer)) {

[ ... ]

> diff --git a/drivers/net/veth.c b/drivers/net/veth.c
> --- a/drivers/net/veth.c
> +++ b/drivers/net/veth.c
> @@ -1341,6 +1341,11 @@ static int veth_newlink(struct net *src_net, struct net_device *dev,
>  	if (IS_ERR(net))
>  		return PTR_ERR(net);
>  
> +	if (!ns_capable(net->user_ns, CAP_NET_ADMIN)) {
        ^^^^^^^^^^

[Severity: Critical]
Is it possible this check suffers from the same confused deputy issue as the
one in vxcan_newlink(), where it evaluates the current task instead of the
socket creator?

> +		put_net(net);
> +		return -EPERM;
> +	}
> +
>  	peer = rtnl_create_link(net, ifname, name_assign_type,
>  				&veth_link_ops, tbp, extack);
>  	if (IS_ERR(peer)) {

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260617-thaws-enid-af4ad67d@mheyne-amazon?part=1